Task: Bring ores.workspace to the clean standard

ores.workspace passes the Component Clean Standard for a component of kind Entity.

• Every checklist item that applies to a component of kind Entity passes, with its evidence recorded on the task.
• Every item that does not apply is recorded as not applicable, with the reason.
• Every generator defect found is fixed at its source, with a regression test.
• ores.workspace is listed in COMPONENTS_UNDER_TEST, and check_component_drift.py --all passes.

Work the Component Clean Standard in its section order, one entity at a time, and record each item's result in the table below.

1. Baseline and inventory (B01 to B05). Record the baseline before any edit.
2. Models (M01 to M10).
3. Protocol (P01 to P06).
4. Generation (G01 to G06).
5. Wiring and data (W01 to W04).
6. Shell (S01, S02).
7. Structure and hygiene (H01 to H03).
8. Verification (V01 to V06), ending with the registry entry.

What the pass did, in order. The model was migrated to the current format first, because every later item reads what it produces. The component's own SQL was then reconciled: the table, its triggers and its hierarchy read are generated, and the four objects the generator cannot express stay hand-written beside them. The generated C++ replaced the hand-written domain, protocol, repository, service and handler, and the two operations that are not entity verbs moved to an operation model with hand-written handlers. The tree was built and tested, the database recreated from scratch, the documentation and the diagrams refreshed, and the component added to the registry.

Every figure below was measured at the head this record names, feature/clean-workspace, and the command that produced it is named beside it.

• The retired = Natural keys= heading is silent, not an error.* The loader reads natural keys only from * Columns entries with :natural_key: true. A model that states its key under the old heading loads, regenerates, and quietly produces a domain type with no such member. name was absent from workspace.hpp, from the protocol's write payload and from every read the generated repository offers. Nothing warned.
• Two facts about a column are not features, and stating them as flags reaches nothing. :has_party_id: true was used by exactly one model in the tree and handled by no loader path; party_id was a real column in the schema and a real member of the hand-written domain type, and the generated one had neither. The migration makes it a column and a second natural key, which is what makes the party-scoped uniqueness expressible at all.
• The generated soft foreign key is tenant-scoped unless the model says otherwise, and that broke tenant provisioning. The hand-written insert trigger validated owner_id across every tenant. The generated one adds tenant_id = NEW.tenant_id, which is right for party_id and wrong for owner_id: the function that provisions a tenant seeds that tenant's Live workspace owned by the provisioning account, which belongs to the system tenant. The test suite found it on its first run, as an insert failure inside ores_iam_provision_tenant_fn.
• A check constraint and a faker word do not agree, and only a run finds it. status_code is constrained to active or archived, and the generated sample was faker::word::noun(). The component had no test before this pass, so the defect had never run.
• The component's SQL is half generated and half not, and the split is stated in one file. workspace_create.sql is the component's aggregator, and it names which of its includes the generator owns. The four hand-written objects are the resolution-order function, the workspace FK validation function other components' triggers call, the trade-scope whitelist table, and the row-level security layer – the last because this table is created before the iam section that defines the function its policy calls.
• The Live workspace lost its guard. The hand-written service refused to archive or delete the Live workspace. In the canonical protocol both are ordinary verbs – a put that states the archived status, and a delete that closes the version window – and the generated service has no seam for the rule. It is recorded here rather than reimplemented, because the Live workspace's lifecycle policy belongs to the workspace feature story in the inbox, not to a clean-up pass.
• The canonical list returns archived rows. The retired list_workspaces filtered on status_code = active; the canonical list returns every current row. A caller that wants the active set filters it. The party-scoped name uniqueness keeps the status_code = active predicate, so an archived name is free to be taken again.
• An operation with no consumer is still an operation. resolve and the trade-scope pair have no caller in the tree. They are kept and modelled rather than deleted, because they are the workspace feature's intended surface and the design doc describes the trade-scope filter as unfinished rather than abandoned. Removal under P03 would be a product decision, not a clean-up one.
• The shell surface is a new composite part, not a model flag. S01 and S02 cannot pass by turning a facet on: the generated units need a part for them to land in, with its own CMake files, its own modeling page and a registration call in the shell application. projects/ores.shell/workspace is that part, built the way the other fifteen are. The first pass recorded the item as an accepted exception, reasoning that the facet would emit into a directory no build reaches; that was true of the tree as it stood and wrong as a conclusion, because the part is the work the item names. The exception is retired and the item passes.

• The namespace documentation headers. G08 wants one per outermost namespace. The component is a composite of three parts and carries none; the scheduler pass added ores.scheduler.hpp to its core part at the same point in its own clean-up.
• Four orphan permissions. workspace::workspaces:archive, :archive_any, :delete_any and workspace::live_workspace:archive are seeded and unreferenced, because the three-tier logic they guarded has no generated expression. They belong to the same decision as the Live workspace's guard above.
• The ER diagram. ores_schema.puml is cross-component and was not refreshed. No gate runs the script that writes it.
• The generated drop does not drop the hierarchy function. The Extra drop statements paste block is the mechanism, and this component implements it. ores.refdata.counterparty generates the same function through the same profile and declares no block, so its drop leaks the function; that is refdata's capture, not this component's.
• The composite's parts are outside every drift gate. A component's modeling_dir is its own modeling/, so the three <part>/modeling/component_overview.org models are discovered by no catalogue entry, and check_component_drift.py never renders them. Their CMakeLists.txt and component_files.cmake are therefore hand-maintained in practice, which is what regenerate_cmake_component_files.py exists to support. This pass rendered the parts by hand and left a capture.

Manual QA scenarios (scaffolded via compass add test_scenario) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

The model is migrated, the component is generated, and the database recreates from the generated schema. The entity's C++ stack – domain, JSON, table, table I/O, generator, protocol, entity, mapper, repository, service and handler – is generated from one entity model; the two operations that are not entity verbs are generated from one operation model; the table, its triggers and its hierarchy read are generated from the same entity model; and both protocol headers have their TypeScript twin.

What stays hand-written is the resolution-order function, the workspace FK validation function other components call, the trade-scope whitelist table, the row-level security layer, the two operation handlers, the component registrar and the service infrastructure – each with its reason above.

Verified: the whole tree builds, ores.workspace.core.tests passes 13 assertions in 3 cases, the shell part's suite passes 48 assertions in 17 cases, compass db recreate -y -k exits 0 and the table reads back with the seventeen columns, seven index names and three checks the hand-written schema carried, all ten generated shell commands ran against the live fleet and answered, and every codegen gate this component is in scope for is green. workspace-cpp joins COMPONENTS_UNDER_TEST with no accepted exception.